Semaphore UI Cross-Site Request Forgery Vulnerability

Semaphore UI, an open-source automation platform, contains a critical Cross-Site Request Forgery (CSRF) vulnerability (CVE-2026-73292) identified in versions prior to 0.0.0-20260707190631-c59c3dc9035b. The vulnerability stems from the password change endpoint (/api/users/<id>/password) failing to enforce CSRF tokens or require re-authentication via a current password. Additionally, session cookies lack 'SameSite' attribute enforcement, facilitating cross-origin request abuse. By tricking an authenticated user into visiting a crafted malicious page, an attacker can silently execute a password change request. This allows for full account takeover, including the administrative account, depending on the targeted user's privileges. Defenders should prioritize patching, as this vulnerability requires minimal user interaction and leads to complete platform compromise.

Impact

Successful exploitation results in the takeover of the targeted user's account. Because this vulnerability allows an attacker to change the administrator's password, it can lead to full administrative compromise of the Semaphore UI instance, enabling an attacker to manipulate projects, run arbitrary automation tasks, and potentially escalate access within the organization's infrastructure.

Recommendation

1. Upgrade Semaphore UI to the latest patched version (>= 0.0.0-20260707190631-c59c3dc9035b) immediately to remediate CVE-2026-73292.
2. Implement global 'SameSite=Strict' or 'SameSite=Lax' cookie policies via load balancers or WAFs if immediate patching is not feasible.
3. Review audit logs for suspicious password change events occurring from unexpected IP addresses or anomalous User-Agent strings.